This page summarizes controls and practices that Agentsapp can currently describe in a verifiable manner. It does not constitute a security certification or a guarantee of invulnerability. The platform will continue to update this information as its controls and infrastructure change.
Infrastructure
-
Database, authentication and primary storage on Supabase, with its primary region in São Paulo, Brazil.
-
Application and server functions deployed on Vercel.
-
The providers that may process Customer Data on behalf of Agentsapp are detailed in the Subprocessor List.
Transmission
Agentsapp's verified production domains use HTTPS with TLS 1.3 and HSTS. Connections with external providers use HTTPS/TLS when the corresponding service offers it.
Multi-tenant architecture and access
Agentsapp uses a multi-tenant architecture. Supabase Row Level Security (RLS) is enabled on the database's public tables and forms part of the access controls. Certain server operations use privileged credentials to execute functions that cannot be performed from the client.
The application and database authorization controls are reviewed as part of the maintenance and hardening of the Platform. The existence of RLS is not presented as an absolute guarantee of isolation.
Credentials and integrations
The credentials for some integrations, such as WhatsApp and Instagram, are stored encrypted at the application level. Other integrations rely on database access controls, environment variables or the corresponding provider's own mechanisms.
Agentsapp does not publish secrets, tokens or access keys in its public documentation. Production access is limited to the accounts and tools necessary to operate the Service.
Logs and operational data
Agentsapp generates technical and audit logs to operate, debug and protect the Service. These logs may include operational identifiers and, depending on the integration, information linked to interactions. Their retention depends on the type of log and the provider used.
Agentsapp seeks to minimize unnecessary information in logs and reviews its logging practices as part of the hardening of the Platform.
Artificial intelligence
AI features may use OpenAI and Anthropic depending on the feature or configuration used. Content sent to those providers is subject to their terms and policies applicable to commercial/API services.
Agentsapp does not use the Customer's private content to train its own general models. The list of AI providers used by Agentsapp is maintained in the Subprocessor List.
Retention, deletion and backups
While an account is active, Agentsapp retains the data necessary to operate the Service and maintain the contracted features and history.
Cancellation of a subscription does not currently result in an automatic and immediate deletion of all data. Valid deletion requests may require manual processing in the affected systems.
The main database uses daily backups managed by Supabase with a rotation window of up to seven days for the plan used by Agentsapp. Database backups are not equivalent to a backup of the files stored in Storage.
Data processed by external providers may remain for the periods established by those providers. Deletion from production does not necessarily mean the instantaneous disappearance of all technical copies.
Processing on behalf of the Customer
When Agentsapp processes data following a customer's instructions, it acts as a data processor or sub-processor in accordance with the Data Processing Addendum (DPA). The Customer retains responsibility for the purpose and lawfulness of the data it decides to process through the Service.
Incidents and contact
If Agentsapp confirms a security incident affecting Personal Data processed on behalf of a Customer, it will apply the notification mechanism set forth in the DPA.
Privacy or security inquiries: bautista@agentsapp.ar